1025-00006 · Graystone Forensics LLC · Vendor Accountability

memo-settlement-summary-recommendations.docx DOCUMENT Data Privacy

82 / 88 ← → ✕

CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT This memorandum is a privileged and confidential communication protected by the attorney-client privilege and the work product doctrine. It has been prepared by Calderwood & Harkness LLP in connection with the provision of legal advice to Quorum Insurance Holdings Corp. This memorandum should not be disclosed, distributed, or otherwise communicated to any third party without the prior written consent of counsel. Inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.

October 28, 2023

MEMORANDUM

I. Executive Summary

The purpose of this memorandum is to summarize the material terms of the Settlement Agreement and Mutual Release (the "Settlement Agreement") executed on October 27, 2023, between Quorum Insurance Holdings Corp. ("Quorum") and Palomar Data Solutions, Inc. ("Palomar"), which resolves all indemnification claims arising from the vendor-originated data breach discovered in April 2023. This memorandum also sets forth our analysis of the financial recovery achieved, the interplay with Quorum's cyber-insurance coverage, the non-monetary benefits secured through the settlement, and our recommendations for management's consideration going forward.

The Settlement Agreement achieves an effective total recovery of $6,156,000 from Palomar, consisting of a $4,200,000 cash payment and $1,956,000 in fee reductions over an eighteen-month period, against total incident response costs of $8,230,250 — representing an approximately 74.8% recovery rate from Palomar alone. When combined with the anticipated insurance recovery from Atlas Mutual Insurance Company above the self-insured retention, Quorum's total recoveries are expected to exceed total incident response costs, resulting in a net financial benefit to the company.

It is our recommendation that Quorum's management affirm the Settlement Agreement as a favorable resolution of the indemnification claims. The settlement represents a strong economic outcome relative to the costs incurred, avoids the substantial expense, delay, and uncertainty associated with breach of contract litigation, and preserves the ongoing vendor relationship with Palomar during the remaining term of the Master Services Agreement. In addition, the settlement is accompanied by MSA Amendment 3, executed concurrently on October 27, 2023, which imposes materially enhanced data security and audit obligations on Palomar, thereby reducing the risk of a similar incident during the remaining term of the engagement.

Importantly, Palomar has made no admission of liability under the Settlement Agreement, and the parties have exchanged mutual releases of all claims, demands, and causes of action related to the data breach incident. The mutual release does not extend to obligations arising under the MSA as amended going forward, including the enhanced security obligations set forth in Amendment 3.

The sections that follow provide a detailed background of the incident and procedural history, a comprehensive summary of the settlement terms, a financial recovery analysis inclusive of the insurance overlay, an assessment of non-monetary benefits, and our evaluation of the litigation alternative and associated risks. We conclude with specific recommendations for management action.

II. Background and Procedural History

A. The Data Breach Incident

On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance, to gain unauthorized access to Palomar Data Solutions, Inc.'s network environment. CVE-2023-0669 was publicly disclosed by Severin Corporation, the manufacturer of the GoAnywhere MFT platform, on February 1, 2023, and a security patch was made available by the vendor on February 7, 2023. Despite the availability of the patch and the critical severity rating assigned to the vulnerability, Palomar had not applied the remediation patch as of the date of the initial unauthorized access on March 14, 2023 — a period of approximately thirty-five days following patch availability. As discussed further in Section II.C below, Palomar's failure to apply the patch within thirty days of vendor release constituted a breach of its obligations under the Data Security Exhibit of the Master Services Agreement.

The exfiltration window spanned approximately thirty-five days, from March 14, 2023 through April 18, 2023. During this period, the threat actor maintained persistent access to Palomar's network and systematically exfiltrated data files containing personally identifiable information and other sensitive data belonging to Quorum's insureds and claimants. The threat actor utilized encrypted channels and staged data in compressed archive files prior to exfiltration, which contributed to the extended dwell time before detection.

Palomar's security operations center detected anomalous outbound data transfers on April 18, 2023, at which point the unauthorized access was identified and the exfiltration was halted. Upon detection, Palomar initiated its internal incident response procedures and engaged its own forensic consultant to conduct a preliminary investigation.

Palomar formally notified Quorum of the incident on April 21, 2023. As detailed below, this notification was approximately twenty-four hours past the forty-eight-hour contractual notification requirement set forth in Section 9.4 of the Master Services Agreement dated November 12, 2019. While the delay was relatively brief in absolute terms, it is contractually significant and was a point of emphasis in our demand correspondence with Palomar's counsel.

Calderwood & Harkness LLP was engaged by Quorum on May 4, 2023, to serve as breach counsel, manage the legal response to the incident, and evaluate Quorum's contractual remedies against Palomar. On May 5, 2023, at our direction and under the protection of attorney-client privilege and the work product doctrine, Quorum retained Graystone Forensics LLC ("Graystone") to conduct an independent forensic investigation of the incident. The decision to retain Graystone under privilege was made to preserve the confidentiality of the forensic findings and to support Quorum's legal strategy with respect to the indemnification claim and any potential litigation.

B. Scope of Compromised Data

Graystone's final forensic report, issued on July 14, 2023, confirmed that the data breach affected a total of 318,247 individuals across twenty-nine states and the District of Columbia. The scope and categories of compromised data are summarized as follows:

Personally Identifiable Information ("PII"): All 318,247 affected individuals had the following categories of PII compromised: full names, dates of birth, Social Security numbers, and driver's license numbers. This data was maintained by Palomar in connection with its claims data processing services for Quorum's personal lines division.

Financial Information: A subset of 84,619 individuals had financial information compromised, including bank account numbers and payment card numbers. This financial data was associated with claims payment processing and premium payment records maintained by Palomar on Quorum's behalf.

Protected Health Information ("PHI"): A further subset of 41,203 individuals had protected health information compromised within the meaning of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable state health privacy laws. The compromised PHI included health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar. The presence of PHI in the compromised data set triggered notification obligations to the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), and contributed to the complexity and cost of the overall incident response.

The breadth and sensitivity of the compromised data categories were significant factors in the scope and cost of the notification and remediation effort, and were central to the indemnification demand asserted against Palomar.

C. Contractual Basis for Indemnification Claim

Quorum's indemnification claim against Palomar is grounded in the Master Services Agreement executed between the parties on November 12, 2019 (the "MSA"), which governs Palomar's provision of claims data processing services to Quorum. The MSA has a five-year initial term, expiring on November 11, 2024, and has been amended twice prior to the settlement:

• Amendment 1 (executed March 3, 2021): Added data processing services for Quorum's QuorumEdge platform and increased the annual contract value ("ACV") from $14,200,000 to $16,300,000.

• Amendment 2 (executed September 15, 2022): Updated the Data Security Exhibit (Exhibit D) to reflect current industry standards, and added a requirement that Palomar obtain and maintain a SOC 2 Type II audit report covering the trust services criteria for security, availability, and confidentiality.

The following provisions of the MSA, as amended, are material to the indemnification claim:

Data Security Exhibit (Exhibit D, as amended by Amendment 2): Exhibit D requires Palomar to implement and maintain commercially reasonable administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of Quorum's data. Among other specific requirements, Exhibit D mandates that Palomar apply patches for critical and high-severity vulnerabilities within thirty (30) days of the date on which a patch is made available by the applicable software vendor. The patch for CVE-2023-0669 was released by Severin Corporation on February 7, 2023. Palomar had not applied the patch as of March 14, 2023, the date of the initial unauthorized access, and forensic evidence indicates the patch was not applied until after the breach was detected on April 18, 2023 — more than seventy days after patch release. Palomar's failure to timely patch this critical vulnerability constitutes a clear breach of its obligations under Exhibit D.

Breach Notification Clause (Section 9.4): Section 9.4 of the MSA requires Palomar to notify Quorum of any Security Incident (as defined in the MSA) within forty-eight (48) hours of Palomar's discovery of such incident. Palomar detected the breach on April 18, 2023, and notified Quorum on April 21, 2023 — approximately seventy-two hours after discovery, or approximately twenty-four hours past the contractual notification deadline. While Palomar's counsel has characterized this delay as de minimis, the contractual language is unambiguous, and the delay constitutes a separate, independent breach of the MSA.

Indemnification (Section 12.2): Section 12.2 of the MSA provides that Palomar shall defend, indemnify, and hold harmless Quorum and its affiliates, officers, directors, and employees from and against any and all losses, damages, costs, and expenses (including reasonable attorneys' fees) arising from or related to Palomar's breach of its data security obligations under Exhibit D or its other obligations under the MSA. Section 12.2 is subject to the liability cap set forth in Section 12.4, which limits Palomar's total aggregate liability under the MSA to two times the trailing twelve-month fees paid by Quorum to Palomar. Based on the current ACV of $16,300,000, the applicable liability cap is $32,600,000. The total incident response costs of $8,230,250 are well within this contractual cap.

Insurance Requirements (Exhibit E): Exhibit E to the MSA requires Palomar to maintain, at its own expense, a cyber liability insurance policy with minimum coverage limits of $10,000,000 per occurrence. Palomar has represented that it maintains such coverage, though the specifics of Palomar's own insurance recovery are not relevant to the resolution of Quorum's claim. We note, however, that the availability of Palomar's insurance was likely a factor in Palomar's willingness to agree to the settlement terms.

D. Demand and Negotiation History

The following summarizes the key milestones in the demand and negotiation process leading to the execution of the Settlement Agreement:

June 20, 2023: Calderwood & Harkness issued a formal breach of contract demand letter to Mercer, Haight & Dunlop LLP, attention Catherine Langford, Partner, counsel to Palomar. The demand letter set forth in detail the contractual bases for the indemnification claim, summarized the forensic evidence of the breach, and demanded full indemnification of all incident response costs in the amount of $8,230,250. The demand letter also reserved Quorum's right to seek additional damages, including any regulatory penalties or fines, third-party claims, and consequential damages, to the extent permitted under the MSA.

July 7, 2023: Palomar responded through Catherine Langford at Mercer, Haight & Dunlop. In its response, Palomar disputed causation, contending that the attack was "highly sophisticated" and that the exploitation of CVE-2023-0669 was part of a broader campaign by a well-resourced threat actor group, and that even prompt patching may not have prevented the intrusion. Palomar also contended that certain of the claimed costs were unreasonable or not directly attributable to Palomar's conduct. In lieu of indemnification, Palomar offered a $1,500,000 "goodwill credit" to be applied against future service fees — a recovery of approximately 18.2% of total costs.

July 25, 2023: Calderwood & Harkness issued a detailed rebuttal letter rejecting the $1,500,000 goodwill credit offer as wholly inadequate. The rebuttal emphasized the following points: (i) CVE-2023-0669 was a known vulnerability with an available patch, and Palomar's failure to apply the patch within the contractual thirty-day window was a straightforward breach of Exhibit D; (ii) the Graystone forensic analysis confirmed that the unpatched GoAnywhere MFT appliance was the initial attack vector, establishing direct causation; (iii) Palomar's late notification under Section 9.4 constituted an independent breach; and (iv) the contractual liability cap of $32,600,000 provided ample headroom for full recovery. The letter also noted that litigation would expose Palomar's security practices to public scrutiny and that the cost of defending such litigation would itself be substantial.

August–October 2023: Following the exchange of demand and rebuttal letters, the parties engaged in direct negotiations through counsel. Multiple telephonic negotiation sessions were conducted between Calderwood & Harkness and Mercer, Haight & Dunlop, with participation at various points from business principals on both sides. An initial draft settlement term sheet was circulated by Calderwood & Harkness on September 18, 2023. Palomar's counsel provided a counter-proposal on October 2, 2023, followed by additional exchanges and revisions. A revised term sheet reflecting the agreed-upon terms was finalized on October 15, 2023, and the parties' respective legal teams prepared the definitive Settlement Agreement and MSA Amendment 3 during the following twelve days.

October 27, 2023: The Settlement Agreement and Mutual Release and MSA Amendment 3 were executed by authorized signatories of both Quorum and Palomar. Copies of the executed agreements are enclosed as Attachments A and B.

III. Summary of Settlement Agreement Terms

Set forth below is a summary of the material terms and provisions of the Settlement Agreement. This summary is provided for the convenience of management and does not purport to modify or supersede the terms of the executed agreement. In the event of any inconsistency between this summary and the Settlement Agreement, the terms of the executed agreement shall control.

A. Cash Payment

Under Section 2.1 of the Settlement Agreement, Palomar shall pay to Quorum a lump-sum cash payment of $4,200,000 within thirty (30) days of the date of execution of the Settlement Agreement (i.e., on or before November 26, 2023). Payment is to be made by wire transfer of immediately available funds to the bank account designated by Quorum in a wire instruction letter to be provided within five (5) business days of execution. The payment obligation is unconditional and not contingent upon any further action by Quorum.

The cash payment amount represents approximately 51% of the total incident response costs of $8,230,250 and approximately 13% of the contractual liability cap of $32,600,000. While the cash payment does not constitute full indemnification of all costs, it is a substantial recovery and, when combined with the fee reduction described below, achieves a total effective monetary recovery that we consider favorable under the circumstances.

B. Fee Reduction

Under Section 2.2 of the Settlement Agreement, Palomar shall apply an eight percent (8%) reduction to all invoiced fees under the MSA for a period of eighteen (18) months, commencing November 1, 2023 and concluding April 30, 2025. The fee reduction applies to the current annual contract value of $16,300,000 and is calculated as follows:

• Annual fee reduction: $16,300,000 × 8% = $1,304,000 per year

• Total fee reduction over 18 months: $1,304,000 × 1.5 years = $1,956,000

The fee reduction applies to all invoices issued by Palomar during the eighteen-month period, regardless of the services or deliverables to which such invoices relate. The reduction is applied as a line-item credit on each invoice and does not affect the calculation of the ACV for purposes of any other provision of the MSA (including the liability cap, which continues to be calculated based on the unadjusted ACV).

We note that the eighteen-month fee reduction period extends approximately six months beyond the current expiration date of the MSA (November 11, 2024). Section 2.2(c) of the Settlement Agreement provides that if the MSA is renewed or extended, the fee reduction shall continue to apply through April 30, 2025. If the MSA is not renewed and expires on its current expiration date, Palomar shall pay to Quorum a lump-sum amount equal to the remaining fee reduction that would have been credited had the MSA continued through April 30, 2025, payable within thirty (30) days of the MSA's expiration.

C. Enhanced Security Measures

Concurrent with the Settlement Agreement, the parties executed MSA Amendment 3, which imposes materially enhanced data security and audit obligations on Palomar for the remaining term of the MSA and any renewal period. The key enhanced security measures are as follows:

• Independent Third-Party Security Assessments: Palomar shall engage, at its sole expense, an independent third-party security assessor reasonably acceptable to Quorum to conduct enhanced annual security assessments of Palomar's information security program, systems, and controls. The initial assessment must be completed within one hundred twenty (120) days of the execution of Amendment 3. Assessment reports shall be provided to Quorum within ten (10) business days of completion.

• Enhanced Patch Management: Palomar shall implement enhanced patch management procedures requiring the application of patches for critical-severity vulnerabilities within fourteen (14) days of vendor patch release, replacing the prior thirty-day standard set forth in the original Exhibit D. High-severity vulnerabilities must be patched within thirty (30) days, and medium-severity vulnerabilities within sixty (60) days.

• Endpoint Detection and Response ("EDR"): Palomar shall deploy enterprise-grade endpoint detection and response capabilities across its entire network environment within ninety (90) days of the execution of Amendment 3 (i.e., by approximately January 25, 2024). The EDR deployment must include continuous monitoring with twenty-four-hour-a-day, seven-day-a-week threat detection and response capabilities.

• Quarterly Vulnerability Scanning: Palomar shall conduct quarterly vulnerability scans of all systems that process, store, or transmit Quorum data, and shall provide summary reports of scan results and remediation actions to Quorum within fifteen (15) business days of each scan cycle.

• Enhanced Incident Notification: The contractual notification period for Security Incidents is reduced from forty-eight (48) hours to twenty-four (24) hours from the time of discovery.

These obligations are set forth in the amended Exhibit D attached to Amendment 3 and are incorporated into the MSA. Palomar's failure to comply with these enhanced obligations would constitute a material breach of the MSA, entitling Quorum to exercise its termination rights under Section 14.2 and to seek indemnification under Section 12.2 for any resulting losses.

D. Mutual Release

Section 4 of the Settlement Agreement contains a mutual release of claims. Specifically:

• Quorum releases and forever discharges Palomar, its affiliates, and their respective officers, directors, employees, agents, and representatives from any and all claims, demands, actions, causes of action, obligations, damages, and liabilities of any kind, whether known or unknown, arising out of or related to the data breach incident, including without limitation any claims for breach of contract, negligence, or any other theory of liability related to the incident.

• Palomar releases and forever discharges Quorum, its affiliates, and their respective officers, directors, employees, agents, and representatives from any and all claims, demands, actions, causes of action, obligations, damages, and liabilities of any kind, whether known or unknown, arising out of or related to the data breach incident.

• The mutual release does not extend to: (i) the parties' obligations under the MSA as amended, including without limitation the enhanced security obligations set forth in Amendment 3; (ii) Palomar's obligation to make the cash payment and fee reductions provided for in the Settlement Agreement; or (iii) any claims that may arise from facts or circumstances occurring after the date of execution of the Settlement Agreement.

• No Admission of Liability: Section 4.3 of the Settlement Agreement expressly provides that neither the Settlement Agreement nor anything contained therein shall be construed as an admission of liability, fault, or wrongdoing by either party. Both parties expressly deny any liability to the other in connection with the data breach incident.

E. Confidentiality

Section 5 of the Settlement Agreement provides that the terms and conditions of the settlement are confidential and shall not be disclosed by either party to any third party, except:

• As required by applicable law, regulation, or order of a court or governmental authority;

• As may be required in connection with Quorum's obligations under the Securities Exchange Act of 1934 and the rules and regulations of the Securities and Exchange Commission;

• To the parties' respective auditors, accountants, tax advisors, and legal counsel, provided such persons are bound by professional obligations of confidentiality;

• To regulators in connection with the pending multistate attorneys general inquiry, the Connecticut Insurance Department examination, and the HHS-OCR compliance review, in each case to the extent reasonably necessary to respond to regulatory inquiries and demonstrate remediation efforts; and

• With the prior written consent of the other party.

The confidentiality provisions survive the termination or expiration of the Settlement Agreement and the MSA.

F. MSA Continuation

The Settlement Agreement confirms that the MSA remains in full force and effect through its current term, expiring November 11, 2024, as amended by Amendments 1, 2, and 3. Nothing in the Settlement Agreement constitutes a waiver of Quorum's rights under the MSA, including without limitation Quorum's right to terminate the MSA for cause under Section 14.2 in the event of any future material breach by Palomar. Similarly, the settlement does not alter the renewal or expiration provisions of the MSA, and Quorum retains full discretion with respect to whether to renew the MSA upon its expiration.

IV. Effective Total Recovery Analysis

A. Total Recovery from Palomar

The total effective recovery from Palomar under the Settlement Agreement is calculated as follows:

B. Total Incident Response Costs

The following table summarizes the total incident response costs incurred by Quorum in connection with the data breach:

The Clearfield Notification Services LLC costs totaling $3,214,500 represent the largest single category of expense. The credit monitoring component ($2,100,000) reflects a negotiated flat fee for twenty-four-month credit monitoring and identity theft protection services for all 318,247 affected individuals, a rate that compares favorably to per-individual pricing in comparable incidents. The Calderwood & Harkness LLP legal fees of $2,163,750 reflect all legal services rendered from engagement on May 4, 2023 through the execution of the Settlement Agreement on October 27, 2023, including breach response management, forensic investigation oversight, regulatory engagement, notification program management, indemnification demand and negotiation, and settlement documentation.

C. Recovery Rate

The settlement achieves the following recovery rate from Palomar:

• $6,156,000 ÷ $8,230,250 = approximately 74.8% of total incident response costs recovered from Palomar

This compares favorably to the initial goodwill credit offer of $1,500,000, which would have represented a recovery rate of only approximately 18.2%. The improvement from the initial offer to the final settlement — an increase of approximately $4,656,000, or a 310% improvement — reflects the strength of the legal and factual position developed by Calderwood & Harkness and the effectiveness of the negotiation strategy.

The settlement recovery is also well within the contractual liability cap of $32,600,000 under Section 12.4 of the MSA. At no point during the negotiation did the liability cap constrain the potential recovery; the settlement amount was driven by the parties' respective assessments of litigation risk, the economic value of the ongoing relationship, and the desire for a prompt and certain resolution.

V. Insurance Coverage and Net Financial Exposure

A. Cyber-Insurance Tower

Quorum maintains the following cyber-insurance coverage relevant to the data breach incident:

A claim under the Atlas primary policy was filed on May 8, 2023, under Claim No. CYB-CLM-2023-05892. Atlas has been cooperative in the claims process to date and has not raised coverage defenses, though a formal coverage determination has not yet been issued pending submission of the final proof of loss and cost summary.

B. Insurance Recovery

The anticipated insurance recovery from Atlas Mutual is calculated as follows:

The total incident response costs of $8,230,250 fall well within the $15,000,000 per-occurrence limit of the Atlas primary policy. Accordingly, the Pinnacle Surplus Lines excess layer is not implicated and no claim against the excess policy is anticipated.

Quorum plans to submit its proof of loss and final cost summary to Atlas Mutual on or before November 15, 2023. The proof of loss will include detailed documentation of all costs incurred, together with supporting invoices and the Graystone forensic report.

C. Net Financial Impact to Quorum

The following analysis illustrates the net financial impact to Quorum after accounting for both the Palomar settlement recovery and the anticipated insurance recovery:

As the table reflects, total anticipated recoveries of $11,886,250 exceed total incident response costs of $8,230,250 by $3,656,000. This result arises because the insurance policy covers the full amount of insured costs above the SIR without offset for the Palomar settlement recovery, while the Palomar recovery independently compensates Quorum for a substantial portion of total costs, including costs within the SIR layer.

As a practical matter, Quorum's out-of-pocket exposure is limited to the $2,500,000 self-insured retention, which is substantially offset — and indeed exceeded — by the combined Palomar cash payment of $4,200,000 and fee reduction of $1,956,000. The net effect is that Quorum's SIR obligation is fully covered by the Palomar settlement, with additional benefit flowing from the combined recovery.

Subrogation Considerations: An important caveat to the foregoing analysis relates to Atlas Mutual's potential subrogation rights. As Quorum's insurer, Atlas Mutual may assert a right of subrogation against Palomar to recover amounts paid under the primary policy. The Settlement Agreement's mutual release was carefully negotiated to apply only as between Quorum and Palomar and does not purport to release, waive, or otherwise affect any independent subrogation claims that Atlas Mutual may hold against Palomar. Whether Atlas elects to pursue a subrogation claim is within Atlas's discretion and would be prosecuted in Atlas's own name.

However, there is a risk that Atlas may assert that Quorum's settlement with Palomar impairs Atlas's subrogation rights, potentially affecting Quorum's right to recover under the policy. While we believe the risk is manageable — the settlement does not release Atlas's independent rights, and the mutual release was drafted with this issue specifically in mind — it is essential that Quorum coordinate closely with Sandra Whitmore-Kim at Whitmore Risk Advisors Inc. (Quorum's insurance broker) and Paul Enriquez at Atlas Mutual regarding the interplay between the Palomar settlement and the insurance claim. This coordination should occur before final submission of the proof of loss to Atlas, and should address any potential issues arising under the policy's "other insurance" or recovery/subrogation provisions (typically found in the policy's General Conditions section).

We recommend that Quorum provide Atlas with notice of the Palomar settlement and a copy of the settlement agreement (subject to confidentiality considerations) as part of the proof of loss submission, to ensure full transparency and to mitigate any argument that Quorum failed to preserve Atlas's subrogation rights. Calderwood & Harkness is available to assist with this coordination and to review any communications with Atlas on this subject prior to submission.

VI. Non-Monetary Benefits

In addition to the financial recovery described above, the settlement and the concurrent execution of MSA Amendment 3 provide significant non-monetary benefits to Quorum.

A. Enhanced Vendor Security Posture

MSA Amendment 3 substantially strengthens Palomar's data security obligations for the remaining term of the MSA and any renewal period. These enhanced obligations directly address the security deficiencies that contributed to the data breach and materially reduce the risk of a similar incident during the remaining period of the engagement. The key enhancements include:

Accelerated Patch Management Timeline: The reduction of the critical vulnerability patching window from thirty (30) days to fourteen (14) days significantly reduces the period of exposure to known vulnerabilities. The original thirty-day standard, while consistent with common industry practice at the time the MSA was executed, proved insufficient to prevent exploitation of CVE-2023-0669. The fourteen-day standard adopted in Amendment 3 reflects the evolving threat landscape and the recognition that critical vulnerabilities are increasingly exploited within days of public disclosure.

Mandatory Endpoint Detection and Response ("EDR") Deployment: The requirement that Palomar deploy enterprise-grade EDR capabilities across its entire network within ninety days addresses the root cause detection gap that allowed the threat actor to maintain persistent access for thirty-five days without detection. EDR technology provides continuous monitoring of endpoint devices and network traffic, enabling rapid identification and containment of threats that evade perimeter defenses. Had EDR been in place at the time of the incident, the dwell time and scope of data exfiltration would likely have been significantly reduced.

Quarterly Vulnerability Scanning with Reporting: The requirement for quarterly vulnerability scans with reporting to Quorum provides Quorum with enhanced ongoing visibility into Palomar's security posture. This reporting obligation enables Quorum's vendor risk management team to monitor Palomar's vulnerability remediation practices on a near-real-time basis and to identify potential concerns before they result in a security incident.

Annual Independent Security Assessment: The requirement for an annual independent third-party security assessment, conducted at Palomar's sole expense, provides Quorum with objective, third-party validation of Palomar's information security program. This goes beyond the SOC 2 Type II audit requirement added in Amendment 2 by providing a more targeted assessment focused on the specific security controls and practices relevant to Palomar's processing of Quorum data.

Enhanced Incident Notification: The reduction of the incident notification window from forty-eight (48) hours to twenty-four (24) hours ensures that Quorum will receive more timely notification of any future security incidents affecting its data. Earlier notification enables Quorum to initiate its own incident response procedures more quickly, potentially reducing the scope and impact of any future incident.

Collectively, these enhanced security measures represent a meaningful and tangible improvement in Palomar's security posture as it relates to Quorum's data. Compliance with these measures should be a priority for monitoring and enforcement by Quorum's vendor risk management team.

B. Regulatory Value

The settlement and the enhanced security measures adopted in Amendment 3 have significant regulatory value for Quorum. Quorum is currently engaged with three regulatory bodies in connection with the data breach:

• Multistate Attorneys General Coalition: A coalition of attorneys general from multiple affected states has initiated an inquiry into the breach. Quorum has been cooperating with the coalition and providing regular submissions regarding its response efforts and vendor oversight practices.

• Connecticut Insurance Department: As Quorum's domestic state regulator, the Connecticut Insurance Department has initiated an examination of Quorum's data security practices and vendor management program in connection with the breach.

• HHS-OCR: Given the compromise of protected health information, Quorum notified HHS-OCR of the breach and is engaged in the agency's standard compliance review process.

In each of these regulatory engagements, the ability to demonstrate that Quorum took aggressive and effective action to hold its vendor accountable — securing both substantial financial recovery and materially enhanced security obligations — supports Quorum's position that it has acted responsibly and proactively in its vendor risk management practices. The settlement terms and enhanced security measures were referenced in the supplemental submission to the multistate attorneys general coalition on November 3, 2023, and we anticipate that they will be similarly referenced in ongoing communications with the Connecticut Insurance Department and HHS-OCR.

A favorable resolution of these regulatory inquiries, without the imposition of material fines or penalties, would further enhance the overall outcome of the incident response. The settlement with Palomar is an important component of Quorum's position in these proceedings.

VII. Risk Assessment and Litigation Alternative

In evaluating the settlement, it is important to consider the alternative — namely, pursuing the indemnification claim through breach of contract litigation. The following analysis addresses the strengths of Quorum's position, the litigation risks, and the relationship considerations that informed our recommendation to settle.

A. Strengths of Quorum's Position

Quorum's legal position with respect to the indemnification claim is strong. The key factual and legal elements that support the claim are well-established:

Clear Breach of MSA Exhibit D: Palomar's failure to apply the patch for CVE-2023-0669 within the required thirty-day window is a straightforward, easily provable breach of the specific patching obligation set forth in the Data Security Exhibit. The date of patch release (February 7, 2023), the date of the initial unauthorized access exploiting the vulnerability (March 14, 2023), and the date the patch was ultimately applied (post-April 18, 2023) are all documented and undisputed. There is no ambiguity in the contractual language requiring patching within thirty days of vendor release, and no reasonable interpretation of the contract that would excuse Palomar's failure to comply.

Clear Breach of MSA Section 9.4: Palomar's notification to Quorum on April 21, 2023 — approximately seventy-two hours after detection on April 18, 2023 — exceeded the forty-eight-hour contractual notification deadline by approximately twenty-four hours. While this breach is less significant standing alone, it reinforces the pattern of non-compliance and supports the overall indemnification claim.

Strong Forensic Evidence of Causation: The Graystone forensic report confirms that the unpatched GoAnywhere MFT appliance was the initial attack vector used by the threat actor to gain unauthorized access to Palomar's network. The forensic evidence establishes a direct causal link between Palomar's failure to patch and the unauthorized access and data exfiltration that followed. This evidence would be compelling in any breach of contract proceeding.

Substantial Contractual Liability Cap: The contractual liability cap of $32,600,000 (2× trailing twelve-month ACV) far exceeds the total incident response costs of $8,230,250, ensuring that the full amount of Quorum's claim falls within the scope of contractual indemnification.

B. Litigation Risks

Despite the strength of Quorum's position, litigation would have entailed meaningful risks and costs:

Sophistication-of-Attack Defense: Palomar's counsel has previewed a defense based on the "sophistication" of the attack, arguing that the threat actor was a well-resourced group that could have found alternative means of access even if the GoAnywhere MFT vulnerability had been patched. While we believe this defense is weak — CVE-2023-0669 was a known, patchable vulnerability, and the forensic evidence directly ties the exploitation of this specific vulnerability to the unauthorized access — it is the type of argument that could introduce uncertainty in litigation, particularly before a jury or an arbitrator unfamiliar with cybersecurity concepts. The defense would require Quorum to retain and present expert testimony to rebut, adding cost and creating a contested issue of fact.

Litigation Cost and Duration: We estimate that breach of contract litigation (whether in court or arbitration) would have generated additional legal fees in the range of $1,500,000 to $3,000,000 over an estimated twelve to eighteen months, exclusive of any appeal. These costs would substantially reduce the net recovery from any judgment or award, even assuming a fully favorable outcome. Under the settlement, the recovery is achieved without these additional costs.

Vendor Relationship Disruption: Litigation against Palomar would have severely strained the ongoing vendor relationship during the remaining term of the MSA, which runs through November 11, 2024. Palomar is Quorum's second-largest vendor for claims data processing, with an annual contract value of $16,300,000. Active litigation between the parties would have created operational risks for Quorum's personal lines claims processing operations, which depend on Palomar's services and are overseen by Robert Wentworth, SVP, Claims Operations. Any disruption or degradation in service quality during the litigation could have had downstream impacts on Quorum's policyholders and regulatory standing.

discovery and Privilege Risks: Litigation discovery would have required Quorum to produce internal communications, documents, and witness testimony related to the incident, the vendor relationship, and Quorum's own data security practices. While the Graystone forensic investigation was conducted under privilege, the boundaries of privilege protection are tested in discovery disputes, and there is an inherent risk that a court could order production of materials that Quorum would prefer to keep confidential. Additionally, discovery could expose internal Quorum communications regarding the vendor selection process, contract negotiation, and oversight of Palomar's performance, which could be used by Palomar in its defense or could create complications in the regulatory proceedings.

Binary Outcome Risk: Litigation outcomes are inherently uncertain and binary — Quorum would either prevail in full or face partial or complete denial of its claim. A settlement provides certainty of recovery, eliminating the risk of an adverse outcome.

C. Relationship Considerations

The vendor relationship with Palomar was a significant factor in the decision to pursue settlement rather than litigation. Palomar is Quorum's second-largest vendor for claims data processing, and the services it provides are integral to Quorum's personal lines claims operations. The following considerations are relevant:

• The annual contract value of $16,300,000 reflects the scale and importance of the engagement. Palomar processes claims data for a substantial portion of Quorum's personal lines book of business.

• Disruption of the relationship during the remaining MSA term could impact Quorum's claims processing operations, with potential downstream effects on claims handling timeliness, policyholder satisfaction, and regulatory compliance.

• Transition to an alternative vendor would require significant lead time (estimated at twelve to eighteen months based on discussions with Robert Wentworth and Priya Deshmukh), substantial transition costs, and would entail its own set of operational and data security risks during the migration period.

• The settlement preserves the relationship while imposing meaningful enhanced security obligations through Amendment 3, effectively turning the incident into an opportunity to strengthen Quorum's vendor oversight framework.

These considerations, together with the economic analysis set forth above, support our conclusion that the settlement represents the optimal outcome for Quorum under the circumstances.

VIII. Recommendations

Based on our analysis of the settlement terms, the financial recovery achieved, the litigation alternative, and the non-monetary benefits secured, we respectfully submit the following recommendations for management's consideration:

1. Affirm the Settlement Agreement as Executed. The Settlement Agreement executed on October 27, 2023 represents a favorable resolution of Quorum's indemnification claims against Palomar. The approximately 74.8% recovery rate from Palomar, combined with the anticipated insurance recovery from Atlas Mutual, more than fully compensates Quorum for the total incident response costs incurred. The settlement avoids the significant cost, delay, and uncertainty of litigation and preserves the ongoing vendor relationship. We recommend that management affirm the settlement terms and authorize all necessary steps to implement the agreement, including provision of wire transfer instructions for the $4,200,000 cash payment.

2. Monitor Palomar's Compliance with Amendment 3 Deadlines. Under Amendment 3, Palomar is required to implement enhanced patch management procedures and deploy endpoint detection and response capabilities across its network within ninety (90) days of execution — i.e., by approximately January 25, 2024. Priya Deshmukh, VP, Vendor Risk Management, should coordinate with Palomar to verify compliance with these deadlines and should establish a formal tracking and reporting mechanism to monitor ongoing compliance with all enhanced security obligations, including the quarterly vulnerability scanning and annual independent security assessment requirements.

3. Coordinate with Insurance Broker and Carrier. Before final submission of the proof of loss to Atlas Mutual, Quorum should coordinate with Sandra Whitmore-Kim at Whitmore Risk Advisors Inc. and Paul Enriquez at Atlas Mutual regarding the interplay between the Palomar settlement recovery and the insurance claim. Specific topics to address include: (i) whether notice of the Palomar settlement should be included in or accompany the proof of loss submission; (ii) the impact, if any, of the settlement on Atlas's subrogation rights and on Quorum's right to recover under the policy; and (iii) whether any provisions of the policy's "other insurance," "recovery," or "subrogation" sections require action by Quorum. Calderwood & Harkness is available to participate in these discussions and to review any communications with the carrier prior to submission.

4. Submit Proof of Loss by November 15, 2023. Quorum should finalize and submit its proof of loss and final cost summary to Atlas Mutual Insurance Company on or before November 15, 2023, to initiate recovery of the anticipated $5,730,250 in insurance proceeds above the self-insured retention. The proof of loss should include detailed documentation of all costs incurred, together with supporting invoices, the Graystone forensic report (to the extent required by the policy), and any other materials requested by the carrier.

5. Continue Engagement with the Multistate AG Coalition and Other Regulators. The supplemental submission filed with the multistate attorneys general coalition on November 3, 2023 included a summary of the settlement terms and the enhanced security measures adopted in Amendment 3. We recommend continued proactive engagement with the AG coalition, the Connecticut Insurance Department, and HHS-OCR to press for favorable closure of these regulatory inquiries. The settlement and enhanced security measures are important components of Quorum's narrative of responsible vendor management and proactive incident response.

6. Brief the Audit Committee. The settlement terms, combined recovery analysis, and net financial impact should be communicated to the Audit Committee of Quorum's Board of Directors. Franklin Reeves, Audit Committee Chair, should receive a summary briefing at the next scheduled Audit Committee meeting. The briefing should cover: (i) the terms of the Settlement Agreement and Amendment 3; (ii) the total recovery from Palomar and anticipated insurance recovery; (iii) the net financial impact to Quorum; (iv) the status of regulatory engagements; and (v) the recommendations set forth in this memorandum. Calderwood & Harkness is available to participate in the Audit Committee briefing if requested.

7. Evaluate MSA Renewal Posture. The current MSA term expires on November 11, 2024, approximately twelve and one-half months from the date of this memorandum. Given the significance of the data breach incident, Quorum should begin evaluating its options with respect to the MSA renewal well in advance of the expiration date. The evaluation should consider: (i) Palomar's compliance with the enhanced security obligations under Amendment 3; (ii) the quality and reliability of Palomar's services during the remaining term; (iii) the availability, capability, and pricing of alternative vendors; (iv) the operational and financial costs and risks of a vendor transition; and (v) the terms and conditions that Quorum would require in any renewed or renegotiated agreement. This evaluation should be led by Priya Deshmukh (Vendor Risk Management) in coordination with Robert Wentworth (Claims Operations) and Thomas Whitfield (Legal), with input from Calderwood & Harkness as appropriate.

IX. Attachments and Enclosures

The following documents are enclosed with this memorandum for your reference:

• Attachment A: Executed Settlement Agreement and Mutual Release between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc. (dated October 27, 2023)

• Attachment B: Executed MSA Amendment 3 — Enhanced Data Security and Audit Provisions (dated October 27, 2023)

• Attachment C: Financial Summary — Total Incident Response Costs and Recovery Analysis (tabular format with all line items, reflecting the analysis set forth in Sections IV and V of this memorandum)

Please do not hesitate to contact us if you have any questions regarding the foregoing or wish to discuss the settlement terms, the recommendations, or any related matter in greater detail. We are available at your convenience to schedule a meeting or conference call to address any questions from management, the Board, or the Audit Committee.

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT This memorandum is a privileged and confidential communication protected by the attorney-client privilege and the work product doctrine. It has been prepared by Calderwood & Harkness LLP solely for the use of Quorum Insurance Holdings Corp. in connection with the provision of legal advice. Distribution is limited to the addressees identified above. This memorandum should not be disclosed, distributed, or otherwise communicated to any third party without the prior written consent of counsel. Inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4100 kostrowski@calderwoodharkness.com

Matter No. 1025-00006

TO:

Margaret D. Calloway, Chief Executive Officer, Quorum Insurance Holdings Corp.

FROM:	Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP
RE:	Summary of Settlement Agreement with Palomar Data Solutions, Inc. — Indemnification Resolution and Recommendations
MATTER NO.:	1025-00006
Recovery Component	Amount
Cash payment (due by November 26, 2023)	$4,200,000
Fee reduction (8% × $16.3M ACV × 18 months)	$1,956,000
Total Effective Recovery from Palomar	$6,156,000
Cost Category	Vendor / Source	Amount
Forensic investigation	Graystone Forensics LLC	$1,847,000
Notification mailing	Clearfield Notification Services LLC	$636,000
Call center services	Clearfield Notification Services LLC	$478,500
Credit monitoring (24-month, negotiated flat fee)	Clearfield Notification Services LLC	$2,100,000
Crisis communications	BrightPath Consulting Group Inc.	$385,000
Legal fees (breach counsel)	Calderwood & Harkness LLP	$2,163,750
Internal costs (IT remediation, employee overtime)	Quorum (estimated)	$620,000
Total Incident Response Costs	$8,230,250
Layer	Carrier	Policy No.	Limits
Primary	Atlas Mutual Insurance Company	CYB-2023-041587	$15,000,000 per occurrence; $2,500,000 self-insured retention ("SIR")
Excess	Pinnacle Surplus Lines Insurance Corp.	XS-CYB-2023-7812	$25,000,000 excess of $15,000,000
Total Tower	$40,000,000
Component	Amount
Total incident response costs	$8,230,250
Less: Self-insured retention (SIR) borne by Quorum	($2,500,000)
Amount covered by Atlas primary policy	$5,730,250
Item	Amount

Total incident response costs	$8,230,250
Less: Palomar cash recovery	($4,200,000)
Less: Palomar fee reduction (18 months)	($1,956,000)
Less: Atlas insurance recovery (above SIR)	($5,730,250)
Total recoveries	($11,886,250)

CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT This memorandum is a privileged and confidential communication protected by the attorney-client privilege and the work product doctrine. It has been prepared by Calderwood & Harkness LLP in connection with the provision of legal advice to Quorum Insurance Holdings Corp. This memorandum should not be disclosed, distributed, or otherwise communicated to any third party without the prior written consent of counsel. Inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.
October 28, 2023
MEMORANDUM
I. Executive Summary
The purpose of this memorandum is to summarize the material terms of the Settlement Agreement and Mutual Release (the "Settlement Agreement") executed on October 27, 2023, between Quorum Insurance Holdings Corp. ("Quorum") and Palomar Data Solutions, Inc. ("Palomar"), which resolves all indemnification claims arising from the vendor-originated data breach discovered in April 2023. This memorandum also sets forth our analysis of the financial recovery achieved, the interplay with Quorum's cyber-insurance coverage, the non-monetary benefits secured through the settlement, and our recommendations for management's consideration going forward.
The Settlement Agreement achieves an effective total recovery of $6,156,000 from Palomar, consisting of a $4,200,000 cash payment and $1,956,000 in fee reductions over an eighteen-month period, against total incident response costs of $8,230,250 — representing an approximately 74.8% recovery rate from Palomar alone. When combined with the anticipated insurance recovery from Atlas Mutual Insurance Company above the self-insured retention, Quorum's total recoveries are expected to exceed total incident response costs, resulting in a net financial benefit to the company.
It is our recommendation that Quorum's management affirm the Settlement Agreement as a favorable resolution of the indemnification claims. The settlement represents a strong economic outcome relative to the costs incurred, avoids the substantial expense, delay, and uncertainty associated with breach of contract litigation, and preserves the ongoing vendor relationship with Palomar during the remaining term of the Master Services Agreement. In addition, the settlement is accompanied by MSA Amendment 3, executed concurrently on October 27, 2023, which imposes materially enhanced data security and audit obligations on Palomar, thereby reducing the risk of a similar incident during the remaining term of the engagement.
Importantly, Palomar has made no admission of liability under the Settlement Agreement, and the parties have exchanged mutual releases of all claims, demands, and causes of action related to the data breach incident. The mutual release does not extend to obligations arising under the MSA as amended going forward, including the enhanced security obligations set forth in Amendment 3.
The sections that follow provide a detailed background of the incident and procedural history, a comprehensive summary of the settlement terms, a financial recovery analysis inclusive of the insurance overlay, an assessment of non-monetary benefits, and our evaluation of the litigation alternative and associated risks. We conclude with specific recommendations for management action.
II. Background and Procedural History
A. The Data Breach Incident
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability in Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance, to gain unauthorized access to Palomar Data Solutions, Inc.'s network environment. CVE-2023-0669 was publicly disclosed by Severin Corporation, the manufacturer of the GoAnywhere MFT platform, on February 1, 2023, and a security patch was made available by the vendor on February 7, 2023. Despite the availability of the patch and the critical severity rating assigned to the vulnerability, Palomar had not applied the remediation patch as of the date of the initial unauthorized access on March 14, 2023 — a period of approximately thirty-five days following patch availability. As discussed further in Section II.C below, Palomar's failure to apply the patch within thirty days of vendor release constituted a breach of its obligations under the Data Security Exhibit of the Master Services Agreement.
The exfiltration window spanned approximately thirty-five days, from March 14, 2023 through April 18, 2023. During this period, the threat actor maintained persistent access to Palomar's network and systematically exfiltrated data files containing personally identifiable information and other sensitive data belonging to Quorum's insureds and claimants. The threat actor utilized encrypted channels and staged data in compressed archive files prior to exfiltration, which contributed to the extended dwell time before detection.
Palomar's security operations center detected anomalous outbound data transfers on April 18, 2023, at which point the unauthorized access was identified and the exfiltration was halted. Upon detection, Palomar initiated its internal incident response procedures and engaged its own forensic consultant to conduct a preliminary investigation.
Palomar formally notified Quorum of the incident on April 21, 2023. As detailed below, this notification was approximately twenty-four hours past the forty-eight-hour contractual notification requirement set forth in Section 9.4 of the Master Services Agreement dated November 12, 2019. While the delay was relatively brief in absolute terms, it is contractually significant and was a point of emphasis in our demand correspondence with Palomar's counsel.
Calderwood & Harkness LLP was engaged by Quorum on May 4, 2023, to serve as breach counsel, manage the legal response to the incident, and evaluate Quorum's contractual remedies against Palomar. On May 5, 2023, at our direction and under the protection of attorney-client privilege and the work product doctrine, Quorum retained Graystone Forensics LLC ("Graystone") to conduct an independent forensic investigation of the incident. The decision to retain Graystone under privilege was made to preserve the confidentiality of the forensic findings and to support Quorum's legal strategy with respect to the indemnification claim and any potential litigation.
B. Scope of Compromised Data
Graystone's final forensic report, issued on July 14, 2023, confirmed that the data breach affected a total of 318,247 individuals across twenty-nine states and the District of Columbia. The scope and categories of compromised data are summarized as follows:
Personally Identifiable Information ("PII"): All 318,247 affected individuals had the following categories of PII compromised: full names, dates of birth, Social Security numbers, and driver's license numbers. This data was maintained by Palomar in connection with its claims data processing services for Quorum's personal lines division.
Financial Information: A subset of 84,619 individuals had financial information compromised, including bank account numbers and payment card numbers. This financial data was associated with claims payment processing and premium payment records maintained by Palomar on Quorum's behalf.
Protected Health Information ("PHI"): A further subset of 41,203 individuals had protected health information compromised within the meaning of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable state health privacy laws. The compromised PHI included health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar. The presence of PHI in the compromised data set triggered notification obligations to the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR"), and contributed to the complexity and cost of the overall incident response.
The breadth and sensitivity of the compromised data categories were significant factors in the scope and cost of the notification and remediation effort, and were central to the indemnification demand asserted against Palomar.
C. Contractual Basis for Indemnification Claim
Quorum's indemnification claim against Palomar is grounded in the Master Services Agreement executed between the parties on November 12, 2019 (the "MSA"), which governs Palomar's provision of claims data processing services to Quorum. The MSA has a five-year initial term, expiring on November 11, 2024, and has been amended twice prior to the settlement:
• Amendment 1 (executed March 3, 2021): Added data processing services for Quorum's QuorumEdge platform and increased the annual contract value ("ACV") from $14,200,000 to $16,300,000.
• Amendment 2 (executed September 15, 2022): Updated the Data Security Exhibit (Exhibit D) to reflect current industry standards, and added a requirement that Palomar obtain and maintain a SOC 2 Type II audit report covering the trust services criteria for security, availability, and confidentiality.
The following provisions of the MSA, as amended, are material to the indemnification claim:
Data Security Exhibit (Exhibit D, as amended by Amendment 2): Exhibit D requires Palomar to implement and maintain commercially reasonable administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of Quorum's data. Among other specific requirements, Exhibit D mandates that Palomar apply patches for critical and high-severity vulnerabilities within thirty (30) days of the date on which a patch is made available by the applicable software vendor. The patch for CVE-2023-0669 was released by Severin Corporation on February 7, 2023. Palomar had not applied the patch as of March 14, 2023, the date of the initial unauthorized access, and forensic evidence indicates the patch was not applied until after the breach was detected on April 18, 2023 — more than seventy days after patch release. Palomar's failure to timely patch this critical vulnerability constitutes a clear breach of its obligations under Exhibit D.
Breach Notification Clause (Section 9.4): Section 9.4 of the MSA requires Palomar to notify Quorum of any Security Incident (as defined in the MSA) within forty-eight (48) hours of Palomar's discovery of such incident. Palomar detected the breach on April 18, 2023, and notified Quorum on April 21, 2023 — approximately seventy-two hours after discovery, or approximately twenty-four hours past the contractual notification deadline. While Palomar's counsel has characterized this delay as de minimis, the contractual language is unambiguous, and the delay constitutes a separate, independent breach of the MSA.
Indemnification (Section 12.2): Section 12.2 of the MSA provides that Palomar shall defend, indemnify, and hold harmless Quorum and its affiliates, officers, directors, and employees from and against any and all losses, damages, costs, and expenses (including reasonable attorneys' fees) arising from or related to Palomar's breach of its data security obligations under Exhibit D or its other obligations under the MSA. Section 12.2 is subject to the liability cap set forth in Section 12.4, which limits Palomar's total aggregate liability under the MSA to two times the trailing twelve-month fees paid by Quorum to Palomar. Based on the current ACV of $16,300,000, the applicable liability cap is $32,600,000. The total incident response costs of $8,230,250 are well within this contractual cap.
Insurance Requirements (Exhibit E): Exhibit E to the MSA requires Palomar to maintain, at its own expense, a cyber liability insurance policy with minimum coverage limits of $10,000,000 per occurrence. Palomar has represented that it maintains such coverage, though the specifics of Palomar's own insurance recovery are not relevant to the resolution of Quorum's claim. We note, however, that the availability of Palomar's insurance was likely a factor in Palomar's willingness to agree to the settlement terms.
D. Demand and Negotiation History
The following summarizes the key milestones in the demand and negotiation process leading to the execution of the Settlement Agreement:
June 20, 2023: Calderwood & Harkness issued a formal breach of contract demand letter to Mercer, Haight & Dunlop LLP, attention Catherine Langford, Partner, counsel to Palomar. The demand letter set forth in detail the contractual bases for the indemnification claim, summarized the forensic evidence of the breach, and demanded full indemnification of all incident response costs in the amount of $8,230,250. The demand letter also reserved Quorum's right to seek additional damages, including any regulatory penalties or fines, third-party claims, and consequential damages, to the extent permitted under the MSA.
July 7, 2023: Palomar responded through Catherine Langford at Mercer, Haight & Dunlop. In its response, Palomar disputed causation, contending that the attack was "highly sophisticated" and that the exploitation of CVE-2023-0669 was part of a broader campaign by a well-resourced threat actor group, and that even prompt patching may not have prevented the intrusion. Palomar also contended that certain of the claimed costs were unreasonable or not directly attributable to Palomar's conduct. In lieu of indemnification, Palomar offered a $1,500,000 "goodwill credit" to be applied against future service fees — a recovery of approximately 18.2% of total costs.
July 25, 2023: Calderwood & Harkness issued a detailed rebuttal letter rejecting the $1,500,000 goodwill credit offer as wholly inadequate. The rebuttal emphasized the following points: (i) CVE-2023-0669 was a known vulnerability with an available patch, and Palomar's failure to apply the patch within the contractual thirty-day window was a straightforward breach of Exhibit D; (ii) the Graystone forensic analysis confirmed that the unpatched GoAnywhere MFT appliance was the initial attack vector, establishing direct causation; (iii) Palomar's late notification under Section 9.4 constituted an independent breach; and (iv) the contractual liability cap of $32,600,000 provided ample headroom for full recovery. The letter also noted that litigation would expose Palomar's security practices to public scrutiny and that the cost of defending such litigation would itself be substantial.
August–October 2023: Following the exchange of demand and rebuttal letters, the parties engaged in direct negotiations through counsel. Multiple telephonic negotiation sessions were conducted between Calderwood & Harkness and Mercer, Haight & Dunlop, with participation at various points from business principals on both sides. An initial draft settlement term sheet was circulated by Calderwood & Harkness on September 18, 2023. Palomar's counsel provided a counter-proposal on October 2, 2023, followed by additional exchanges and revisions. A revised term sheet reflecting the agreed-upon terms was finalized on October 15, 2023, and the parties' respective legal teams prepared the definitive Settlement Agreement and MSA Amendment 3 during the following twelve days.
October 27, 2023: The Settlement Agreement and Mutual Release and MSA Amendment 3 were executed by authorized signatories of both Quorum and Palomar. Copies of the executed agreements are enclosed as Attachments A and B.
III. Summary of Settlement Agreement Terms
Set forth below is a summary of the material terms and provisions of the Settlement Agreement. This summary is provided for the convenience of management and does not purport to modify or supersede the terms of the executed agreement. In the event of any inconsistency between this summary and the Settlement Agreement, the terms of the executed agreement shall control.
A. Cash Payment
Under Section 2.1 of the Settlement Agreement, Palomar shall pay to Quorum a lump-sum cash payment of $4,200,000 within thirty (30) days of the date of execution of the Settlement Agreement (i.e., on or before November 26, 2023). Payment is to be made by wire transfer of immediately available funds to the bank account designated by Quorum in a wire instruction letter to be provided within five (5) business days of execution. The payment obligation is unconditional and not contingent upon any further action by Quorum.
The cash payment amount represents approximately 51% of the total incident response costs of $8,230,250 and approximately 13% of the contractual liability cap of $32,600,000. While the cash payment does not constitute full indemnification of all costs, it is a substantial recovery and, when combined with the fee reduction described below, achieves a total effective monetary recovery that we consider favorable under the circumstances.
B. Fee Reduction
Under Section 2.2 of the Settlement Agreement, Palomar shall apply an eight percent (8%) reduction to all invoiced fees under the MSA for a period of eighteen (18) months, commencing November 1, 2023 and concluding April 30, 2025. The fee reduction applies to the current annual contract value of $16,300,000 and is calculated as follows:
• Annual fee reduction: $16,300,000 × 8% = $1,304,000 per year
• Total fee reduction over 18 months: $1,304,000 × 1.5 years = $1,956,000
The fee reduction applies to all invoices issued by Palomar during the eighteen-month period, regardless of the services or deliverables to which such invoices relate. The reduction is applied as a line-item credit on each invoice and does not affect the calculation of the ACV for purposes of any other provision of the MSA (including the liability cap, which continues to be calculated based on the unadjusted ACV).
We note that the eighteen-month fee reduction period extends approximately six months beyond the current expiration date of the MSA (November 11, 2024). Section 2.2(c) of the Settlement Agreement provides that if the MSA is renewed or extended, the fee reduction shall continue to apply through April 30, 2025. If the MSA is not renewed and expires on its current expiration date, Palomar shall pay to Quorum a lump-sum amount equal to the remaining fee reduction that would have been credited had the MSA continued through April 30, 2025, payable within thirty (30) days of the MSA's expiration.
C. Enhanced Security Measures
Concurrent with the Settlement Agreement, the parties executed MSA Amendment 3, which imposes materially enhanced data security and audit obligations on Palomar for the remaining term of the MSA and any renewal period. The key enhanced security measures are as follows:
• Independent Third-Party Security Assessments: Palomar shall engage, at its sole expense, an independent third-party security assessor reasonably acceptable to Quorum to conduct enhanced annual security assessments of Palomar's information security program, systems, and controls. The initial assessment must be completed within one hundred twenty (120) days of the execution of Amendment 3. Assessment reports shall be provided to Quorum within ten (10) business days of completion.
• Enhanced Patch Management: Palomar shall implement enhanced patch management procedures requiring the application of patches for critical-severity vulnerabilities within fourteen (14) days of vendor patch release, replacing the prior thirty-day standard set forth in the original Exhibit D. High-severity vulnerabilities must be patched within thirty (30) days, and medium-severity vulnerabilities within sixty (60) days.
• Endpoint Detection and Response ("EDR"): Palomar shall deploy enterprise-grade endpoint detection and response capabilities across its entire network environment within ninety (90) days of the execution of Amendment 3 (i.e., by approximately January 25, 2024). The EDR deployment must include continuous monitoring with twenty-four-hour-a-day, seven-day-a-week threat detection and response capabilities.
• Quarterly Vulnerability Scanning: Palomar shall conduct quarterly vulnerability scans of all systems that process, store, or transmit Quorum data, and shall provide summary reports of scan results and remediation actions to Quorum within fifteen (15) business days of each scan cycle.
• Enhanced Incident Notification: The contractual notification period for Security Incidents is reduced from forty-eight (48) hours to twenty-four (24) hours from the time of discovery.
These obligations are set forth in the amended Exhibit D attached to Amendment 3 and are incorporated into the MSA. Palomar's failure to comply with these enhanced obligations would constitute a material breach of the MSA, entitling Quorum to exercise its termination rights under Section 14.2 and to seek indemnification under Section 12.2 for any resulting losses.
D. Mutual Release
Section 4 of the Settlement Agreement contains a mutual release of claims. Specifically:
• Quorum releases and forever discharges Palomar, its affiliates, and their respective officers, directors, employees, agents, and representatives from any and all claims, demands, actions, causes of action, obligations, damages, and liabilities of any kind, whether known or unknown, arising out of or related to the data breach incident, including without limitation any claims for breach of contract, negligence, or any other theory of liability related to the incident.
• Palomar releases and forever discharges Quorum, its affiliates, and their respective officers, directors, employees, agents, and representatives from any and all claims, demands, actions, causes of action, obligations, damages, and liabilities of any kind, whether known or unknown, arising out of or related to the data breach incident.
• The mutual release does not extend to: (i) the parties' obligations under the MSA as amended, including without limitation the enhanced security obligations set forth in Amendment 3; (ii) Palomar's obligation to make the cash payment and fee reductions provided for in the Settlement Agreement; or (iii) any claims that may arise from facts or circumstances occurring after the date of execution of the Settlement Agreement.
• No Admission of Liability: Section 4.3 of the Settlement Agreement expressly provides that neither the Settlement Agreement nor anything contained therein shall be construed as an admission of liability, fault, or wrongdoing by either party. Both parties expressly deny any liability to the other in connection with the data breach incident.
E. Confidentiality
Section 5 of the Settlement Agreement provides that the terms and conditions of the settlement are confidential and shall not be disclosed by either party to any third party, except:
• As required by applicable law, regulation, or order of a court or governmental authority;
• As may be required in connection with Quorum's obligations under the Securities Exchange Act of 1934 and the rules and regulations of the Securities and Exchange Commission;
• To the parties' respective auditors, accountants, tax advisors, and legal counsel, provided such persons are bound by professional obligations of confidentiality;
• To regulators in connection with the pending multistate attorneys general inquiry, the Connecticut Insurance Department examination, and the HHS-OCR compliance review, in each case to the extent reasonably necessary to respond to regulatory inquiries and demonstrate remediation efforts; and
• With the prior written consent of the other party.
The confidentiality provisions survive the termination or expiration of the Settlement Agreement and the MSA.
F. MSA Continuation
The Settlement Agreement confirms that the MSA remains in full force and effect through its current term, expiring November 11, 2024, as amended by Amendments 1, 2, and 3. Nothing in the Settlement Agreement constitutes a waiver of Quorum's rights under the MSA, including without limitation Quorum's right to terminate the MSA for cause under Section 14.2 in the event of any future material breach by Palomar. Similarly, the settlement does not alter the renewal or expiration provisions of the MSA, and Quorum retains full discretion with respect to whether to renew the MSA upon its expiration.
IV. Effective Total Recovery Analysis
A. Total Recovery from Palomar
The total effective recovery from Palomar under the Settlement Agreement is calculated as follows:
B. Total Incident Response Costs
The following table summarizes the total incident response costs incurred by Quorum in connection with the data breach:
The Clearfield Notification Services LLC costs totaling $3,214,500 represent the largest single category of expense. The credit monitoring component ($2,100,000) reflects a negotiated flat fee for twenty-four-month credit monitoring and identity theft protection services for all 318,247 affected individuals, a rate that compares favorably to per-individual pricing in comparable incidents. The Calderwood & Harkness LLP legal fees of $2,163,750 reflect all legal services rendered from engagement on May 4, 2023 through the execution of the Settlement Agreement on October 27, 2023, including breach response management, forensic investigation oversight, regulatory engagement, notification program management, indemnification demand and negotiation, and settlement documentation.
C. Recovery Rate
The settlement achieves the following recovery rate from Palomar:
• $6,156,000 ÷ $8,230,250 = approximately 74.8% of total incident response costs recovered from Palomar
This compares favorably to the initial goodwill credit offer of $1,500,000, which would have represented a recovery rate of only approximately 18.2%. The improvement from the initial offer to the final settlement — an increase of approximately $4,656,000, or a 310% improvement — reflects the strength of the legal and factual position developed by Calderwood & Harkness and the effectiveness of the negotiation strategy.
The settlement recovery is also well within the contractual liability cap of $32,600,000 under Section 12.4 of the MSA. At no point during the negotiation did the liability cap constrain the potential recovery; the settlement amount was driven by the parties' respective assessments of litigation risk, the economic value of the ongoing relationship, and the desire for a prompt and certain resolution.
V. Insurance Coverage and Net Financial Exposure
A. Cyber-Insurance Tower
Quorum maintains the following cyber-insurance coverage relevant to the data breach incident:
A claim under the Atlas primary policy was filed on May 8, 2023, under Claim No. CYB-CLM-2023-05892. Atlas has been cooperative in the claims process to date and has not raised coverage defenses, though a formal coverage determination has not yet been issued pending submission of the final proof of loss and cost summary.
B. Insurance Recovery
The anticipated insurance recovery from Atlas Mutual is calculated as follows:
The total incident response costs of $8,230,250 fall well within the $15,000,000 per-occurrence limit of the Atlas primary policy. Accordingly, the Pinnacle Surplus Lines excess layer is not implicated and no claim against the excess policy is anticipated.
Quorum plans to submit its proof of loss and final cost summary to Atlas Mutual on or before November 15, 2023. The proof of loss will include detailed documentation of all costs incurred, together with supporting invoices and the Graystone forensic report.
C. Net Financial Impact to Quorum
The following analysis illustrates the net financial impact to Quorum after accounting for both the Palomar settlement recovery and the anticipated insurance recovery:
As the table reflects, total anticipated recoveries of $11,886,250 exceed total incident response costs of $8,230,250 by $3,656,000. This result arises because the insurance policy covers the full amount of insured costs above the SIR without offset for the Palomar settlement recovery, while the Palomar recovery independently compensates Quorum for a substantial portion of total costs, including costs within the SIR layer.
As a practical matter, Quorum's out-of-pocket exposure is limited to the $2,500,000 self-insured retention, which is substantially offset — and indeed exceeded — by the combined Palomar cash payment of $4,200,000 and fee reduction of $1,956,000. The net effect is that Quorum's SIR obligation is fully covered by the Palomar settlement, with additional benefit flowing from the combined recovery.
Subrogation Considerations: An important caveat to the foregoing analysis relates to Atlas Mutual's potential subrogation rights. As Quorum's insurer, Atlas Mutual may assert a right of subrogation against Palomar to recover amounts paid under the primary policy. The Settlement Agreement's mutual release was carefully negotiated to apply only as between Quorum and Palomar and does not purport to release, waive, or otherwise affect any independent subrogation claims that Atlas Mutual may hold against Palomar. Whether Atlas elects to pursue a subrogation claim is within Atlas's discretion and would be prosecuted in Atlas's own name.
However, there is a risk that Atlas may assert that Quorum's settlement with Palomar impairs Atlas's subrogation rights, potentially affecting Quorum's right to recover under the policy. While we believe the risk is manageable — the settlement does not release Atlas's independent rights, and the mutual release was drafted with this issue specifically in mind — it is essential that Quorum coordinate closely with Sandra Whitmore-Kim at Whitmore Risk Advisors Inc. (Quorum's insurance broker) and Paul Enriquez at Atlas Mutual regarding the interplay between the Palomar settlement and the insurance claim. This coordination should occur before final submission of the proof of loss to Atlas, and should address any potential issues arising under the policy's "other insurance" or recovery/subrogation provisions (typically found in the policy's General Conditions section).
We recommend that Quorum provide Atlas with notice of the Palomar settlement and a copy of the settlement agreement (subject to confidentiality considerations) as part of the proof of loss submission, to ensure full transparency and to mitigate any argument that Quorum failed to preserve Atlas's subrogation rights. Calderwood & Harkness is available to assist with this coordination and to review any communications with Atlas on this subject prior to submission.
VI. Non-Monetary Benefits
In addition to the financial recovery described above, the settlement and the concurrent execution of MSA Amendment 3 provide significant non-monetary benefits to Quorum.
A. Enhanced Vendor Security Posture
MSA Amendment 3 substantially strengthens Palomar's data security obligations for the remaining term of the MSA and any renewal period. These enhanced obligations directly address the security deficiencies that contributed to the data breach and materially reduce the risk of a similar incident during the remaining period of the engagement. The key enhancements include:
Accelerated Patch Management Timeline: The reduction of the critical vulnerability patching window from thirty (30) days to fourteen (14) days significantly reduces the period of exposure to known vulnerabilities. The original thirty-day standard, while consistent with common industry practice at the time the MSA was executed, proved insufficient to prevent exploitation of CVE-2023-0669. The fourteen-day standard adopted in Amendment 3 reflects the evolving threat landscape and the recognition that critical vulnerabilities are increasingly exploited within days of public disclosure.
Mandatory Endpoint Detection and Response ("EDR") Deployment: The requirement that Palomar deploy enterprise-grade EDR capabilities across its entire network within ninety days addresses the root cause detection gap that allowed the threat actor to maintain persistent access for thirty-five days without detection. EDR technology provides continuous monitoring of endpoint devices and network traffic, enabling rapid identification and containment of threats that evade perimeter defenses. Had EDR been in place at the time of the incident, the dwell time and scope of data exfiltration would likely have been significantly reduced.
Quarterly Vulnerability Scanning with Reporting: The requirement for quarterly vulnerability scans with reporting to Quorum provides Quorum with enhanced ongoing visibility into Palomar's security posture. This reporting obligation enables Quorum's vendor risk management team to monitor Palomar's vulnerability remediation practices on a near-real-time basis and to identify potential concerns before they result in a security incident.
Annual Independent Security Assessment: The requirement for an annual independent third-party security assessment, conducted at Palomar's sole expense, provides Quorum with objective, third-party validation of Palomar's information security program. This goes beyond the SOC 2 Type II audit requirement added in Amendment 2 by providing a more targeted assessment focused on the specific security controls and practices relevant to Palomar's processing of Quorum data.
Enhanced Incident Notification: The reduction of the incident notification window from forty-eight (48) hours to twenty-four (24) hours ensures that Quorum will receive more timely notification of any future security incidents affecting its data. Earlier notification enables Quorum to initiate its own incident response procedures more quickly, potentially reducing the scope and impact of any future incident.
Collectively, these enhanced security measures represent a meaningful and tangible improvement in Palomar's security posture as it relates to Quorum's data. Compliance with these measures should be a priority for monitoring and enforcement by Quorum's vendor risk management team.
B. Regulatory Value
The settlement and the enhanced security measures adopted in Amendment 3 have significant regulatory value for Quorum. Quorum is currently engaged with three regulatory bodies in connection with the data breach:
• Multistate Attorneys General Coalition: A coalition of attorneys general from multiple affected states has initiated an inquiry into the breach. Quorum has been cooperating with the coalition and providing regular submissions regarding its response efforts and vendor oversight practices.
• Connecticut Insurance Department: As Quorum's domestic state regulator, the Connecticut Insurance Department has initiated an examination of Quorum's data security practices and vendor management program in connection with the breach.
• HHS-OCR: Given the compromise of protected health information, Quorum notified HHS-OCR of the breach and is engaged in the agency's standard compliance review process.
In each of these regulatory engagements, the ability to demonstrate that Quorum took aggressive and effective action to hold its vendor accountable — securing both substantial financial recovery and materially enhanced security obligations — supports Quorum's position that it has acted responsibly and proactively in its vendor risk management practices. The settlement terms and enhanced security measures were referenced in the supplemental submission to the multistate attorneys general coalition on November 3, 2023, and we anticipate that they will be similarly referenced in ongoing communications with the Connecticut Insurance Department and HHS-OCR.
A favorable resolution of these regulatory inquiries, without the imposition of material fines or penalties, would further enhance the overall outcome of the incident response. The settlement with Palomar is an important component of Quorum's position in these proceedings.
VII. Risk Assessment and Litigation Alternative
In evaluating the settlement, it is important to consider the alternative — namely, pursuing the indemnification claim through breach of contract litigation. The following analysis addresses the strengths of Quorum's position, the litigation risks, and the relationship considerations that informed our recommendation to settle.
A. Strengths of Quorum's Position
Quorum's legal position with respect to the indemnification claim is strong. The key factual and legal elements that support the claim are well-established:
Clear Breach of MSA Exhibit D: Palomar's failure to apply the patch for CVE-2023-0669 within the required thirty-day window is a straightforward, easily provable breach of the specific patching obligation set forth in the Data Security Exhibit. The date of patch release (February 7, 2023), the date of the initial unauthorized access exploiting the vulnerability (March 14, 2023), and the date the patch was ultimately applied (post-April 18, 2023) are all documented and undisputed. There is no ambiguity in the contractual language requiring patching within thirty days of vendor release, and no reasonable interpretation of the contract that would excuse Palomar's failure to comply.
Clear Breach of MSA Section 9.4: Palomar's notification to Quorum on April 21, 2023 — approximately seventy-two hours after detection on April 18, 2023 — exceeded the forty-eight-hour contractual notification deadline by approximately twenty-four hours. While this breach is less significant standing alone, it reinforces the pattern of non-compliance and supports the overall indemnification claim.
Strong Forensic Evidence of Causation: The Graystone forensic report confirms that the unpatched GoAnywhere MFT appliance was the initial attack vector used by the threat actor to gain unauthorized access to Palomar's network. The forensic evidence establishes a direct causal link between Palomar's failure to patch and the unauthorized access and data exfiltration that followed. This evidence would be compelling in any breach of contract proceeding.
Substantial Contractual Liability Cap: The contractual liability cap of $32,600,000 (2× trailing twelve-month ACV) far exceeds the total incident response costs of $8,230,250, ensuring that the full amount of Quorum's claim falls within the scope of contractual indemnification.
B. Litigation Risks
Despite the strength of Quorum's position, litigation would have entailed meaningful risks and costs:
Sophistication-of-Attack Defense: Palomar's counsel has previewed a defense based on the "sophistication" of the attack, arguing that the threat actor was a well-resourced group that could have found alternative means of access even if the GoAnywhere MFT vulnerability had been patched. While we believe this defense is weak — CVE-2023-0669 was a known, patchable vulnerability, and the forensic evidence directly ties the exploitation of this specific vulnerability to the unauthorized access — it is the type of argument that could introduce uncertainty in litigation, particularly before a jury or an arbitrator unfamiliar with cybersecurity concepts. The defense would require Quorum to retain and present expert testimony to rebut, adding cost and creating a contested issue of fact.
Litigation Cost and Duration: We estimate that breach of contract litigation (whether in court or arbitration) would have generated additional legal fees in the range of $1,500,000 to $3,000,000 over an estimated twelve to eighteen months, exclusive of any appeal. These costs would substantially reduce the net recovery from any judgment or award, even assuming a fully favorable outcome. Under the settlement, the recovery is achieved without these additional costs.
Vendor Relationship Disruption: Litigation against Palomar would have severely strained the ongoing vendor relationship during the remaining term of the MSA, which runs through November 11, 2024. Palomar is Quorum's second-largest vendor for claims data processing, with an annual contract value of $16,300,000. Active litigation between the parties would have created operational risks for Quorum's personal lines claims processing operations, which depend on Palomar's services and are overseen by Robert Wentworth, SVP, Claims Operations. Any disruption or degradation in service quality during the litigation could have had downstream impacts on Quorum's policyholders and regulatory standing.
discovery and Privilege Risks: Litigation discovery would have required Quorum to produce internal communications, documents, and witness testimony related to the incident, the vendor relationship, and Quorum's own data security practices. While the Graystone forensic investigation was conducted under privilege, the boundaries of privilege protection are tested in discovery disputes, and there is an inherent risk that a court could order production of materials that Quorum would prefer to keep confidential. Additionally, discovery could expose internal Quorum communications regarding the vendor selection process, contract negotiation, and oversight of Palomar's performance, which could be used by Palomar in its defense or could create complications in the regulatory proceedings.
Binary Outcome Risk: Litigation outcomes are inherently uncertain and binary — Quorum would either prevail in full or face partial or complete denial of its claim. A settlement provides certainty of recovery, eliminating the risk of an adverse outcome.
C. Relationship Considerations
The vendor relationship with Palomar was a significant factor in the decision to pursue settlement rather than litigation. Palomar is Quorum's second-largest vendor for claims data processing, and the services it provides are integral to Quorum's personal lines claims operations. The following considerations are relevant:
• The annual contract value of $16,300,000 reflects the scale and importance of the engagement. Palomar processes claims data for a substantial portion of Quorum's personal lines book of business.
• Disruption of the relationship during the remaining MSA term could impact Quorum's claims processing operations, with potential downstream effects on claims handling timeliness, policyholder satisfaction, and regulatory compliance.
• Transition to an alternative vendor would require significant lead time (estimated at twelve to eighteen months based on discussions with Robert Wentworth and Priya Deshmukh), substantial transition costs, and would entail its own set of operational and data security risks during the migration period.
• The settlement preserves the relationship while imposing meaningful enhanced security obligations through Amendment 3, effectively turning the incident into an opportunity to strengthen Quorum's vendor oversight framework.
These considerations, together with the economic analysis set forth above, support our conclusion that the settlement represents the optimal outcome for Quorum under the circumstances.
VIII. Recommendations
Based on our analysis of the settlement terms, the financial recovery achieved, the litigation alternative, and the non-monetary benefits secured, we respectfully submit the following recommendations for management's consideration:
1. Affirm the Settlement Agreement as Executed. The Settlement Agreement executed on October 27, 2023 represents a favorable resolution of Quorum's indemnification claims against Palomar. The approximately 74.8% recovery rate from Palomar, combined with the anticipated insurance recovery from Atlas Mutual, more than fully compensates Quorum for the total incident response costs incurred. The settlement avoids the significant cost, delay, and uncertainty of litigation and preserves the ongoing vendor relationship. We recommend that management affirm the settlement terms and authorize all necessary steps to implement the agreement, including provision of wire transfer instructions for the $4,200,000 cash payment.
2. Monitor Palomar's Compliance with Amendment 3 Deadlines. Under Amendment 3, Palomar is required to implement enhanced patch management procedures and deploy endpoint detection and response capabilities across its network within ninety (90) days of execution — i.e., by approximately January 25, 2024. Priya Deshmukh, VP, Vendor Risk Management, should coordinate with Palomar to verify compliance with these deadlines and should establish a formal tracking and reporting mechanism to monitor ongoing compliance with all enhanced security obligations, including the quarterly vulnerability scanning and annual independent security assessment requirements.
3. Coordinate with Insurance Broker and Carrier. Before final submission of the proof of loss to Atlas Mutual, Quorum should coordinate with Sandra Whitmore-Kim at Whitmore Risk Advisors Inc. and Paul Enriquez at Atlas Mutual regarding the interplay between the Palomar settlement recovery and the insurance claim. Specific topics to address include: (i) whether notice of the Palomar settlement should be included in or accompany the proof of loss submission; (ii) the impact, if any, of the settlement on Atlas's subrogation rights and on Quorum's right to recover under the policy; and (iii) whether any provisions of the policy's "other insurance," "recovery," or "subrogation" sections require action by Quorum. Calderwood & Harkness is available to participate in these discussions and to review any communications with the carrier prior to submission.
4. Submit Proof of Loss by November 15, 2023. Quorum should finalize and submit its proof of loss and final cost summary to Atlas Mutual Insurance Company on or before November 15, 2023, to initiate recovery of the anticipated $5,730,250 in insurance proceeds above the self-insured retention. The proof of loss should include detailed documentation of all costs incurred, together with supporting invoices, the Graystone forensic report (to the extent required by the policy), and any other materials requested by the carrier.
5. Continue Engagement with the Multistate AG Coalition and Other Regulators. The supplemental submission filed with the multistate attorneys general coalition on November 3, 2023 included a summary of the settlement terms and the enhanced security measures adopted in Amendment 3. We recommend continued proactive engagement with the AG coalition, the Connecticut Insurance Department, and HHS-OCR to press for favorable closure of these regulatory inquiries. The settlement and enhanced security measures are important components of Quorum's narrative of responsible vendor management and proactive incident response.
6. Brief the Audit Committee. The settlement terms, combined recovery analysis, and net financial impact should be communicated to the Audit Committee of Quorum's Board of Directors. Franklin Reeves, Audit Committee Chair, should receive a summary briefing at the next scheduled Audit Committee meeting. The briefing should cover: (i) the terms of the Settlement Agreement and Amendment 3; (ii) the total recovery from Palomar and anticipated insurance recovery; (iii) the net financial impact to Quorum; (iv) the status of regulatory engagements; and (v) the recommendations set forth in this memorandum. Calderwood & Harkness is available to participate in the Audit Committee briefing if requested.
7. Evaluate MSA Renewal Posture. The current MSA term expires on November 11, 2024, approximately twelve and one-half months from the date of this memorandum. Given the significance of the data breach incident, Quorum should begin evaluating its options with respect to the MSA renewal well in advance of the expiration date. The evaluation should consider: (i) Palomar's compliance with the enhanced security obligations under Amendment 3; (ii) the quality and reliability of Palomar's services during the remaining term; (iii) the availability, capability, and pricing of alternative vendors; (iv) the operational and financial costs and risks of a vendor transition; and (v) the terms and conditions that Quorum would require in any renewed or renegotiated agreement. This evaluation should be led by Priya Deshmukh (Vendor Risk Management) in coordination with Robert Wentworth (Claims Operations) and Thomas Whitfield (Legal), with input from Calderwood & Harkness as appropriate.
IX. Attachments and Enclosures
The following documents are enclosed with this memorandum for your reference:
• Attachment A: Executed Settlement Agreement and Mutual Release between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc. (dated October 27, 2023)
• Attachment B: Executed MSA Amendment 3 — Enhanced Data Security and Audit Provisions (dated October 27, 2023)
• Attachment C: Financial Summary — Total Incident Response Costs and Recovery Analysis (tabular format with all line items, reflecting the analysis set forth in Sections IV and V of this memorandum)
Please do not hesitate to contact us if you have any questions regarding the foregoing or wish to discuss the settlement terms, the recommendations, or any related matter in greater detail. We are available at your convenience to schedule a meeting or conference call to address any questions from management, the Board, or the Audit Committee.
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT This memorandum is a privileged and confidential communication protected by the attorney-client privilege and the work product doctrine. It has been prepared by Calderwood & Harkness LLP solely for the use of Quorum Insurance Holdings Corp. in connection with the provision of legal advice. Distribution is limited to the addressees identified above. This memorandum should not be disclosed, distributed, or otherwise communicated to any third party without the prior written consent of counsel. Inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-4100 kostrowski@calderwoodharkness.com
Matter No. 1025-00006
TO: | Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.
Margaret D. Calloway, Chief Executive Officer, Quorum Insurance Holdings Corp.
FROM: | Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP
RE: | Summary of Settlement Agreement with Palomar Data Solutions, Inc. — Indemnification Resolution and Recommendations
MATTER NO.: | 1025-00006
Recovery Component | Amount
Cash payment (due by November 26, 2023) | $4,200,000
Fee reduction (8% × $16.3M ACV × 18 months) | $1,956,000
Total Effective Recovery from Palomar | $6,156,000
Cost Category | Vendor / Source | Amount
Forensic investigation | Graystone Forensics LLC | $1,847,000
Notification mailing | Clearfield Notification Services LLC | $636,000
Call center services | Clearfield Notification Services LLC | $478,500
Credit monitoring (24-month, negotiated flat fee) | Clearfield Notification Services LLC | $2,100,000
Crisis communications | BrightPath Consulting Group Inc. | $385,000
Legal fees (breach counsel) | Calderwood & Harkness LLP | $2,163,750
Internal costs (IT remediation, employee overtime) | Quorum (estimated) | $620,000
Total Incident Response Costs | $8,230,250
Layer | Carrier | Policy No. | Limits
Primary | Atlas Mutual Insurance Company | CYB-2023-041587 | $15,000,000 per occurrence; $2,500,000 self-insured retention ("SIR")
Excess | Pinnacle Surplus Lines Insurance Corp. | XS-CYB-2023-7812 | $25,000,000 excess of $15,000,000
Total Tower | $40,000,000
Component | Amount
Total incident response costs | $8,230,250
Less: Self-insured retention (SIR) borne by Quorum | ($2,500,000)
Amount covered by Atlas primary policy | $5,730,250
Item | Amount
Total incident response costs | $8,230,250
Less: Palomar cash recovery | ($4,200,000)
Less: Palomar fee reduction (18 months) | ($1,956,000)
Less: Atlas insurance recovery (above SIR) | ($5,730,250)
Total recoveries | ($11,886,250)

CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

MEMORANDUM

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts